BIOS Version: G4ET62WW (2.04 )

Current Network card: Intel Corporation Centrino Wireless-N 2200 [8086:0891]

I successfully installed an Intel Dual Band Wireless-AC 7260 wireless card by modifying the whitelist in the BIOS. I've compiled this step-by-step guide with references as I had trouble finding a similar resource online.

IBM COMPATIBLE 486 BIOS COPYRIGHT Phoenix Technologies, Ltd Phoenix BIOS SC-T v2.2

• MX25L6406E (8MB)
• MX25L3206E (4MB) (Under frame) (This is the BIOS chip I need to flash)
• There is another EEPROM on the underside of the bios which contains the bios passwords which I am not going to touch.

• Your Thinkpad laptop (of course)
• New PCI-E Network card (Approx. $20 from eBay or Aliexpress)
• A second computer (I used another Linux computer. A Windows computer can work, but I haven't tried it)
• A high quality (small) Phillips screwdriver, all of the screws in the laptop are Phillips, and you don't want to accidentally strip any screws.
• Hex driver for the studs on the SVGA connector
• CH341A programmer (Approx. $3 from eBay or Aliexpress)
• SOIC8 Test clip (Approx. $4 from eBay or Aliexpress)

1. Determine current wireless card VID:PID via Linux: lspci -nn
2. Download Flashrom
3. Download UEFITool
4. Following the Hardware manual, disassemble the laptop to access the system board.
5. Place the system on a non-conductive surface (As you will be powering up a portion via the CH341A programmer.
6. Pin 1 of the test clip is the wire with the Red stripe, which goes towards the corner of the memory chip with the circle.
   1. I was fortunate enough to have a similar memory chip from another device I was able to use to test the programmer connections ahead of time.
7. Connect the test clip to the programmer, (Facing downwards, in the top half of the ZIF socket)
8. Read the existing BIOS
   1. flashrom -p ch341a_spi -c “MX25L3206E/MX25L3208E” -r ORIGINALBIOS.ROM
      1. Read multiple times to verify the data is correct. (Compare via MD5SUM)
      2. Note: If you are getting errors, or inconsistant data, try adjusting the test clip slightly.
9. IMPORTANT: Make a copy of the original bios, or email it to yourself so you don't accidentally lose it.
10. Modify bios
11. Linux: cp ORIGINALBIOS.ROM MODIFIEDBIOS.ROM
    1. Open firmware (MODIFIEDBIOS.ROM) in UEFItool (Works well under wine)
       1. File > Search, Select GUID, search for 79E0EDD7-9D1D-4F41-AE1A-F896169E5216 (LenovoWMAPolicy)
       2. GUID pattern “79E0EDD7-9D1D-4F41-AE1A-F896169E5216” found as “D7EDE0791D9D414FAE1AF896169E5216” in 79E0EDD7-9D1D-4F41-AE1A-F896169E5216 at header-offset 0h
       3. Go to PE32 Image section, right click, “Extract as is”
       4. Save as LenovoWmaPolicyDxe_orig.sct
       5. Linux: cp LenovoWmaPolicyDxe_orig.sct LenovoWmaPolicyDxe_mod.sct
    2. Using a hex editor, search for whitelist
       1. Linux: hexedit LenovoWmaPolicyDxe_mod.sct
       2. /(to search), EC10<enter> (I've chosen to modify the 10EC Vender device)
       3. Change EC10 to 8680 (New device is 8086:08B1)
       4. Change 7681 to B108
       5. Change EC10 to 8680 (Secondary VID:PID is 8086:4070)
       6. Change 9581 to 7040
       7. Change 9517 to 8780 (Bluetooth VID:PID is 8087:4070)
       8. Change 2007 to DC07
       9. Ctrl-x (To save & exit)
    3. Back in UEFITool
       1. Right click on the same PE32 Image section again, select “Replace as is”
       2. File > Save Image file, save as MODIFIEDBIOS.ROM
12. Flash new bios
    1. flashrom -p ch341a_spi -c “MX25L3206E/MX25L3208E” -w MODIFIEDBIOS.ROM
    2. (It did take a couple attempts, and as I mentioned earlier, I did try fiddling with the test clip to ensure it was properly seated.
13. Verify bios:
    1. flashrom -p ch341a_spi -c “MX25L3206E/MX25L3208E” -v MODIFIEDBIOS.ROM
    2. Reassemble laptop to the point of booting
    3. basically, everything up to the trim, keyboard, and display.
    4. I used the existing thermal compound for testing, then I cleaned it off to apply new thermal compound prior to final assembly
    5. Disconnect AC adaptor from wall
    6. Being careful no loose connectors are reading on the motherboard, I plugged in the disconnected AC adaptor (this way I can apply power without accidentally jostling anything)
    7. Plug AC adaptor into wall
    8. Power on via keyboard
    9. Take note of BIOS message, if you receive an error, take a photo of it.
    10. Unplug AC adaptor from wall
14. Finish reassembling laptop
    1. At this point I cleaned as I went, cleaning dust out of crevices & such.
    2. Clean off the existing thermal compound, put new thermal compound on the CPU (and GPU if you have discrete graphics)
15. Note: I'm using a separate Bluetooth adaptor, so I'm not concerned about enabling the integrated Bluetooth (Which involves placing kaptop tape over a pin)

1. Download matching firmware (Bootable CD) from Lenovo website
2. Extract firmware
   1. geteltorito will extract the bootable disk image from the downloaded ISO Firmware files

TODO: Revise list as I made an error in reading to hex file

• Supported by flashrom
  • flashrom -p ch341a_spi -V
• T530 flashing directions on Coreboot.org
  • It should be safe to read/flash the chip in situ…

Tested on a similar flash chip

# flashrom -p ch341a_spi -c "MX25L3206E/MX25L3208E" -r T530_BIOS_MX25L3206E -V
flashrom v0.9.9-r1955 on Linux 3.16.0-4-686-pae (i686)
flashrom is free software, get the source code at https://flashrom.org

flashrom was built with GCC 4.9.2, little endian
Command line (7 args): flashrom -p ch341a_spi -c MX25L3206E/MX25L3208E -r T530_BIOS_MX25L3206E -V
Calibrating delay loop... OS timer resolution is 2 usecs, 745M loops per second, 10 myus = 12 us, 100 myus = 101 us, 1000 myus = 1006 us, 10000 myus = 9992 us, 8 myus = 10 us, OK.
Initializing ch341a_spi programmer
Device revision is 3.0.4
The following protocols are supported: SPI.
Probing for Macronix MX25L3206E/MX25L3208E, 4096 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2016
Found Macronix flash chip "MX25L3206E/MX25L3208E" (4096 kB, SPI) on ch341a_spi.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Reading flash... done.

• ifdtool

• xxx.PAT are CPU Microcode files
• xxx.hsh are CPU Microcode hash files
• something.FL1 the actual BIOS image.
• There's also .FL2, that's the Embedded controller¹⁾

• https://github.com/LongSoft/UEFITool/releases/tag/A32
  • https://habrahabr.ru/post/211574/
  • Deleting a Whitelist bios in laptops example Lenovo X230
    • GUID: 79E0EDD7-9D1D-4F41-AE1A-F896169E5216_2207
  • Coreboot - T530
    • https://www.coreboot.org/Board:lenovo/x230
    • https://www.flashrom.org/ISP
• https://habrahabr.ru/post/211574/
• http://bioshacking.blogspot.ca/
• Other BIOS mods
  • https://www.bios-mods.com/forum/Thread-T420s-1-41-whitelist-removed-other-changes
• http://www.endeer.cz/bios.tools/bios.html
• http://kornatya.blogspot.ca/2011/10/i2c-projekt-vol3.html?showComment=1417911091378
• Other
  • https://www.bios-mods.com/forum/Thread-TUTORIAL-Lenovo-X230-Tablet-BIOS-Whitelist-Removal-Hardware-Flash
  • https://www.bios-mods.com/forum/archive/index.php?thread-21048.html

Currently: 15.6“, 16×9, 1366×768

http://replacethinkpadscreen.blogspot.ca/2013/01/replacing-t530s-screen.html

Possible replacement: B156HW01 V.4